Re: Issue with CsrfViewMiddleware and "referer" checking for trusted and secure subdomains

2015-05-29 Thread André Tavares
Hey, I also came across this "issue" which I believe will become very common as architectures as the one described above are starting to be more common. Moreover, IMHO the overall way that Django handles CORS issues is sub-optimal... another issue that I keep bumping against is having multiple

Re: Issue with CsrfViewMiddleware and "referer" checking for trusted and secure subdomains

2015-05-29 Thread Ramiro Morales
On Fri, May 29, 2015 at 12:41 AM, Troy Grosfield wrote: > > I have the following domain and subdomains both are trusted and both are > secure (https): > > https://example.com > https://api.example.com > > When making POST ajax request from https://example.com to > https://api.example.com I see t

Re: Fellow Report - April 24, 2015

2015-05-29 Thread Tim Graham
It seems you are correct. I reopened the ticket and left a comment with the result of my investigation. On Thursday, May 28, 2015 at 10:36:09 PM UTC-4, Chris Moirano wrote: > > Hey Tim, > > Sorry if this may be an unnecessary question but the ticket 24704 > (Development server does not restart o

Re: URL namespaces

2015-05-29 Thread Marten Kenbeek
> > I think it's an unlikely case anyway, but out of curiosity what are the > workarounds? In the case of a 2-tuple, just pass (admin.site.urls[0], 'dashboard'). In the case of a module, you'll have to directly import the module and pass a (patterns, app_name) tuple. If an app has templates

Re: Issue with CsrfViewMiddleware and "referer" checking for trusted and secure subdomains

2015-05-29 Thread Troy Grosfield
Thanks @andre for the idea. I have seen the stuff from django-cors-headers and use that app in my app. However, I can't help, but feel like changing the *request.MEA['HTTP_REFERER']* feels way to hacky for my liking. I know this would work as a workaround until the ticket that @ramiromorales

Re: Issue with CsrfViewMiddleware and "referer" checking for trusted and secure subdomains

2015-05-29 Thread Troy Grosfield
This same issue is being discussed here as well: - https://groups.google.com/forum/#!topic/django-developers/tEEw02RhV0M On Friday, May 29, 2015 at 8:23:43 AM UTC-6, Troy Grosfield wrote: > > Thanks @andre for the idea. I have seen the stuff from > django-cors-headers and use that app i

Re: Feedback #24496 - Check CSRF Referer against CSRF_COOKIE_DOMAIN

2015-05-29 Thread Troy Grosfield
I just recently posted on the same issue: - https://groups.google.com/forum/#!topic/django-developers/6kUiODYObnU I definitely would like to see some change to make communicating between trusted subdomains easier. In my case it's *https://example.com* posting data to *https://api.exampl

Re: Fate of sql* management commands

2015-05-29 Thread Marcin Nowak
On Monday, March 30, 2015 at 1:58:02 AM UTC+2, Russell Keith-Magee wrote: > > >> >> *What is the new way to dump the sql schema of currently installed django >> appz ?* It'd maybe be worth that I provide a doc patch to inform users >> about it. >> *If there is none, is there an agreement to res

Re: Fate of sql* management commands

2015-05-29 Thread Tim Graham
There's a ticket waiting someone to implement what has been discussed: https://code.djangoproject.com/ticket/24481 On Friday, May 29, 2015 at 12:05:48 PM UTC-4, Marcin Nowak wrote: > > > > On Monday, March 30, 2015 at 1:58:02 AM UTC+2, Russell Keith-Magee wrote: >> >> >>> >>> *What is the new way

Re: Fate of sql* management commands

2015-05-29 Thread Marcin Nowak
Thanks, I didn't saw it. But I've found quick&dirty ad-hoc solution using monkey patching. Just include this snippet in project`s __init__: from django.core.management import sql def check_for_migrations_bypassed(*args, **kw): pass sql.check_for_migrations = check_for_migration_bypassed (T